mirror of https://github.com/grpc/grpc.git
[Audit Logging] End2end test for audit logging in authorization policy (#33196)
I generated a new client key and cert where a Spiffe ID is added as the URI SAN. As such, we are able to test the audit log contains the principal correctly. Update: I switched to use the test logger to verify the log content and removed stdout logger here because one the failure of [RBE Windows Debug C/C++](https://source.cloud.google.com/results/invocations/c3187f41-bb1f-44b3-b2b1-23f38e47386d). Update again: Refactored the test logger in a util such that the authz engine test also uses the same logger. Subsequently, xDS e2e test will also use it. --------- Co-authored-by: rockspore <rockspore@users.noreply.github.com>pull/33240/head
Luwei Ge
2 years ago
committed by
GitHub
parent
4d85f514cb
commit
de9d398e8f
14 changed files with 1011 additions and 118 deletions
@ -0,0 +1,15 @@ |
||||
[req] |
||||
distinguished_name = req_distinguished_name |
||||
req_extensions = v3_req |
||||
prompt = no |
||||
|
||||
[req_distinguished_name] |
||||
CN = testclient3 |
||||
|
||||
[v3_req] |
||||
basicConstraints = CA:FALSE |
||||
keyUsage = nonRepudiation, digitalSignature, keyEncipherment |
||||
subjectAltName = @alt_names |
||||
|
||||
[alt_names] |
||||
URI = spiffe://foo.com/bar/baz |
||||
@ -0,0 +1,28 @@ |
||||
-----BEGIN PRIVATE KEY----- |
||||
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDNLEJrQ4+tX7+I |
||||
vyMLYg1xlz0TBEnZqPM3A81QoB0w5XuE5/wYp2vLmqz3c8b3tIoxSjl+i0E9KPKG |
||||
4YgFkQCOQFu2UBTjzlt2+zlWsFwGPXkKsmCNRw8Ey8cJqH4krk974yw1TQVZ8S/h |
||||
0yiyEsCgxjSHR1+Zjv7IqNBVuw+zgwR5QyirxNuaddrwysxotESoROTlesXiURfK |
||||
ywHWcIGgaxmaOAszcLjIK4zNkSYziVf7AMq4NvDmZWH/fe40nBhh4AflufRkcI/j |
||||
xogrCF6zA1CWwJO4AtSbnLqw7okkZlWY4opKG8VQXB9JwztPBSadCEwYh48DDM5l |
||||
Gyk0QPQ7AgMBAAECggEAPUEPe1KqXIqPdlYKMmXNubH7a+gF3FPSeQRLkdybmnOI |
||||
0v8nhnzFc/3z0dTg/CcMcvbD/4G3sni9H4PJxk+qKM4SE3YJJpH/QKB0V+tDLiHA |
||||
N29V4Bfs5fOosrt5HZ5k4InMMwWRqW6WawdNyQxMMjO6jwDCC+hjLKkpuc6lO2RD |
||||
DxSbZ1qnoEFevhn/A6WUaq/aQ+S56NvczUksP/EDsGD0aPSDpYx/ghj1Ps8A/H75 |
||||
K+TnDsWpdMgW3/BIAAvIGRm5AVROuISwoAAtgvB1+fm9lMGJ/EPCtmCm3UZwmtYO |
||||
+YFznC4zvTzNZ7QswstO9A1FRGm1X90G6Rkdr1CCcQKBgQD1nLMFS6WBBTZEDk74 |
||||
7fOmf0wBWdPW7kzcJfSz8dcedBfsZSffBPo23ePFHamGGW8YZRk48lBfNjPEXT/v |
||||
Otn4CoQIbEWPq8xIWjkAEP8JPj+t1KPkxFcL2r5+XlkSj+lmrvTlzsncz/QcU++j |
||||
MsKq50jshX0R1nf9KkZHsqlz7QKBgQDV2bcR0T7LdYvNon5gPbHv046Oc3XEQLD4 |
||||
qlUsCxoIiSJCMe/mVrUI6EJl5qUH6pUO9FEyUSgQcIHZ0cYl6LnUSTR0+v6VzSOL |
||||
fHVb470RmOEorcPVeTV3craMhyoFBWTBs5J1ipq7/1bjrt1mqqoIXtdaHARQ7g+j |
||||
l2m9T3pTxwKBgQCVjDP0pXrAdEv2ZD/xkfEpD5lXuTojRDXIVdQJPNee01E9vtno |
||||
ET/I6JInE0iFPjdGw0f4RJJrZrVeeujS4SKWxNBf0I0KTbC03TqXr8GZ/y0GytKA |
||||
GIxny2jxyMCzbKzQuPakdqSyrmwUU4c191JQfUMJwL3Gfq/Qlkz0mvRSgQKBgDLV |
||||
xVID9rRw5eHlHbuNDu5e0QWF5tnXMvp5qzOEFBUxXCZ2LnwH4pMSey40DMj796EN |
||||
bPvUFP0LcaKw3jSGxR30pPal77z2fdubo15LnddAC04bOHFXleEmMMTpIJD+/juZ |
||||
j1hHsY69HQ+UsubD7RV+Th0KifAfFzKhPK6W5RJjAoGADfvdJhDFh/EqlS0IwKcP |
||||
SkZeIEKZjXQoyQHQs9BSEKS/YljOh1T/bSUgHasvQBLru2DwBZtjOUOr3AnspUWc |
||||
Ds6esvYqCmrejbAgH339q3ljyUAszOE5sCsz924WhMDzSaGCG4diPqIdRvXmQEhs |
||||
MjLXW5+g+AJOBB2XhJaxmB8= |
||||
-----END PRIVATE KEY----- |
||||
@ -0,0 +1,23 @@ |
||||
-----BEGIN CERTIFICATE----- |
||||
MIID1zCCAr+gAwIBAgIUM1A1YAb9yiRy8KEZ0Yw+Oqeyff0wDQYJKoZIhvcNAQEL |
||||
BQAwVjELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM |
||||
GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDEPMA0GA1UEAwwGdGVzdGNhMB4XDTIz |
||||
MDUxODE3MTYwNVoXDTMzMDUxNTE3MTYwNVowFjEUMBIGA1UEAwwLdGVzdGNsaWVu |
||||
dDMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDNLEJrQ4+tX7+IvyML |
||||
Yg1xlz0TBEnZqPM3A81QoB0w5XuE5/wYp2vLmqz3c8b3tIoxSjl+i0E9KPKG4YgF |
||||
kQCOQFu2UBTjzlt2+zlWsFwGPXkKsmCNRw8Ey8cJqH4krk974yw1TQVZ8S/h0yiy |
||||
EsCgxjSHR1+Zjv7IqNBVuw+zgwR5QyirxNuaddrwysxotESoROTlesXiURfKywHW |
||||
cIGgaxmaOAszcLjIK4zNkSYziVf7AMq4NvDmZWH/fe40nBhh4AflufRkcI/jxogr |
||||
CF6zA1CWwJO4AtSbnLqw7okkZlWY4opKG8VQXB9JwztPBSadCEwYh48DDM5lGyk0 |
||||
QPQ7AgMBAAGjgdwwgdkwCQYDVR0TBAIwADALBgNVHQ8EBAMCBeAwIwYDVR0RBBww |
||||
GoYYc3BpZmZlOi8vZm9vLmNvbS9iYXIvYmF6MB0GA1UdDgQWBBTnAcMwRonIKLo4 |
||||
MPWq1QNGJFbt9TB7BgNVHSMEdDByoVqkWDBWMQswCQYDVQQGEwJBVTETMBEGA1UE |
||||
CAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRk |
||||
MQ8wDQYDVQQDDAZ0ZXN0Y2GCFFqz9Fbx3Mviz+lLmDbYi/YAYQ+aMA0GCSqGSIb3 |
||||
DQEBCwUAA4IBAQA2rDFPPcQEbQbV8ywaKaSsAHP8te7GVxBC3F18TVD+i8HNL1UU |
||||
gYXdVXYMPPKaNgOTY2SXx/73J74T3rTBf4aL/GBe9qOiNtV1lwVJDvswBHZ5obtd |
||||
aeBq3o1z0af9lGX/Q6JjO97/uovAuqmDGXFSPafTZAcvepKmlvQcmJnEUantlUCG |
||||
UWchPMbyoaOFmgD+b1fmj2/A2jFUyaK1tk5KlJMYCrWK16tUtVZk4mWytjijhpaJ |
||||
QBYOaX2tE1+E7LaXIVg/ZmYi7yfXCakopKCLY8DKDbLpXZKtUFjQAA8xXCcRV2Zc |
||||
5/et+LMsmzeD8rn3m5KN7uzWNTbQl/pvJi1Y |
||||
-----END CERTIFICATE----- |
||||
@ -0,0 +1,76 @@ |
||||
//
|
||||
// Copyright 2023 gRPC authors.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
//
|
||||
|
||||
#include <grpc/support/port_platform.h> |
||||
|
||||
#include "test/core/util/audit_logging_utils.h" |
||||
|
||||
#include <algorithm> |
||||
#include <memory> |
||||
#include <string> |
||||
#include <vector> |
||||
|
||||
#include "absl/status/statusor.h" |
||||
#include "absl/strings/string_view.h" |
||||
|
||||
#include <grpc/grpc_audit_logging.h> |
||||
#include <grpc/support/json.h> |
||||
|
||||
#include "src/core/lib/json/json_writer.h" |
||||
|
||||
namespace grpc_core { |
||||
namespace testing { |
||||
|
||||
namespace { |
||||
|
||||
constexpr absl::string_view kLoggerName = "test_logger"; |
||||
|
||||
using experimental::AuditContext; |
||||
using experimental::AuditLogger; |
||||
using experimental::AuditLoggerFactory; |
||||
using experimental::Json; |
||||
|
||||
} // namespace
|
||||
|
||||
absl::string_view TestAuditLogger::name() const { return kLoggerName; } |
||||
void TestAuditLogger::Log(const AuditContext& context) { |
||||
audit_logs_->push_back(JsonDump(Json::FromObject({ |
||||
{"rpc_method", Json::FromString(std::string(context.rpc_method()))}, |
||||
{"principal", Json::FromString(std::string(context.principal()))}, |
||||
{"policy_name", Json::FromString(std::string(context.policy_name()))}, |
||||
{"matched_rule", Json::FromString(std::string(context.matched_rule()))}, |
||||
{"authorized", Json::FromBool(context.authorized())}, |
||||
}))); |
||||
} |
||||
|
||||
absl::string_view TestAuditLoggerFactory::Config::name() const { |
||||
return kLoggerName; |
||||
} |
||||
|
||||
absl::string_view TestAuditLoggerFactory::name() const { return kLoggerName; } |
||||
|
||||
absl::StatusOr<std::unique_ptr<AuditLoggerFactory::Config>> |
||||
TestAuditLoggerFactory::ParseAuditLoggerConfig(const Json&) { |
||||
return std::make_unique<Config>(); |
||||
} |
||||
|
||||
std::unique_ptr<AuditLogger> TestAuditLoggerFactory::CreateAuditLogger( |
||||
std::unique_ptr<AuditLoggerFactory::Config>) { |
||||
return std::make_unique<TestAuditLogger>(audit_logs_); |
||||
} |
||||
|
||||
} // namespace testing
|
||||
} // namespace grpc_core
|
||||
@ -0,0 +1,70 @@ |
||||
//
|
||||
// Copyright 2023 gRPC authors.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
//
|
||||
|
||||
#ifndef GRPC_TEST_CORE_UTIL_AUDIT_LOGGING_UTILS_H |
||||
#define GRPC_TEST_CORE_UTIL_AUDIT_LOGGING_UTILS_H |
||||
|
||||
#include <grpc/support/port_platform.h> |
||||
|
||||
#include <memory> |
||||
#include <string> |
||||
#include <vector> |
||||
|
||||
#include "absl/status/statusor.h" |
||||
#include "absl/strings/string_view.h" |
||||
|
||||
#include <grpc/grpc_audit_logging.h> |
||||
#include <grpc/support/json.h> |
||||
|
||||
namespace grpc_core { |
||||
namespace testing { |
||||
|
||||
class TestAuditLogger : public experimental::AuditLogger { |
||||
public: |
||||
explicit TestAuditLogger(std::vector<std::string>* audit_logs) |
||||
: audit_logs_(audit_logs) {} |
||||
|
||||
absl::string_view name() const override; |
||||
void Log(const experimental::AuditContext& context) override; |
||||
|
||||
private: |
||||
std::vector<std::string>* audit_logs_; |
||||
}; |
||||
|
||||
class TestAuditLoggerFactory : public experimental::AuditLoggerFactory { |
||||
public: |
||||
class Config : public AuditLoggerFactory::Config { |
||||
absl::string_view name() const override; |
||||
std::string ToString() const override { return "{}"; } |
||||
}; |
||||
|
||||
explicit TestAuditLoggerFactory(std::vector<std::string>* audit_logs) |
||||
: audit_logs_(audit_logs) {} |
||||
|
||||
absl::string_view name() const override; |
||||
absl::StatusOr<std::unique_ptr<AuditLoggerFactory::Config>> |
||||
ParseAuditLoggerConfig(const experimental::Json&) override; |
||||
std::unique_ptr<experimental::AuditLogger> CreateAuditLogger( |
||||
std::unique_ptr<AuditLoggerFactory::Config>) override; |
||||
|
||||
private: |
||||
std::vector<std::string>* audit_logs_; |
||||
}; |
||||
|
||||
} // namespace testing
|
||||
} // namespace grpc_core
|
||||
|
||||
#endif // GRPC_TEST_CORE_UTIL_AUDIT_LOGGING_UTILS_H
|
||||
Loading…
Reference in new issue